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What is Claimed is: 

1 . A method for obtaining data about a transaction in a computer system 
5 comprising: 

receiving at least one message at each of a plurality of nodes in connection with 
performing a service of said transaction; 

filtering said at least one message at each of said plurality of nodes in accordance 
with a current set of one or more rules producing local filtered data at each of said 
1 0 plurality of nodes; and 

processing, at each of said plurality of nodes, said local filtered data producing 
aggregated data about said transaction. 

2. The method of Claim 1, wherein each of at least a portion of said plurality of 

1 5 nodes is one of: a single instance of a web service, an application server, a host computer, 
a geographical computer site. 

3. The method of Claim 1, wherein at least two nodes of said plurality of nodes 
are associated with performing processing for a single application. 

20 

4. The method of Claim 1, wherein said filtering at each of said plurality of nodes 
is performed in real-time while said each node is servicing a request. 
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5. The method of Claim 4, further comprising: 

collecting said aggregated data from each of said plurality of nodes about said 
transaction. 

6. The method of Claim 4, further comprising: 

collecting said aggregated data from a portion of said plurality of nodes about said 
transaction. 

7. The method of Claim 1, further comprising: 

aggregating XML message data received at each of said plurality of nodes, said 
plurality of nodes being a distributed network of service node peers. 

8. The method of Claim 6, wherein each of said plurality of nodes is an 
application performing an operation in connection with servicing a transaction. 

9. The method of Claim 8, wherein said current set of rules is evaluated in 
accordance with each received message. 

10. The method of Claim 9, further comprising: 

revising said current set of rules at one of said plurality of nodes while said one 
node is servicing a request. 
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1 1 . The method of Claim 9, wherein each rule in said current set of rules includes 
a condition portion and an action portion, and the method further comprising: 

evaluating a condition portion of a first rule in accordance with a first received 
message wherein said condition portion evaluates to false and said action portion is not 
performed; and 

evaluating said condition portion of said first rule in accordance with a second 
received message wherein said condition portion evaluates to true and said action portion 
is performed. 

12. The method of Claim 11, wherein said action portion includes performing at 
least one of: outputting data to a destination and invoking an application. 

13. The method of Claim 1, wherein a transaction is determined in accordance 
with at least one of: a transaction identifier, a customer identifier, and a timestamp 
included in each of said at least one message. 

14. The method of Claim 13, wherein said processing includes analyzing said 
local filtered data at at least a portion of said plurality of nodes in accordance with a time- 
coherency and key-value pattern matching. 

15. The method of Claim 14, further comprising: 

determining a first time for performing a first operation at a first of said plurality 
of nodes; 
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determining a second time for performing a second operation at a second of said 
plurality of nodes; 

analyzing first local filtered data at said first node using an identifier associated 
with a transaction producing a first transaction data set; 

analyzing second local filtered data at said second node using said identifier 
producing a second transaction data set; and 

determining that said first and second transaction data sets are messages received 
by each of said first and second nodes for performing different operations for a same 
transaction at different points in time. 

16. The method of Claim 15, further comprising: 

determining a processing path of operations performed by one or more of said 
plurality of nodes in connection with servicing said transaction in accordance with said 
identifier associated with said transaction. 
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17. A computer program product method for obtaining data about a transaction in 
a computer system comprising: 

executable code that receives at least one message at each of a plurality of nodes 
in connection with performing a service of said transaction; 

executable code that filters said at least one message at each of said plurality of 
nodes in accordance with a current set of one or more rules producing local filtered data 
at each of said plurality of nodes; and 

executable code that processes, at each of said plurality of nodes, said local 
filtered data producing aggregated data about said transaction. 

18. The computer program product of Claim 17, wherein each of at least a 
portion of said plurality of nodes is one of: a single instance of a web service, an 
application server, a host computer, a geographical computer site. 

19. The computer program product of Claim 17, wherein at least two nodes of 
said plurality of nodes are associated with performing processing for a single application. 

20. The computer program product of Claim 17, wherein said executable code 
that filters at each of said plurality of nodes performs filtering in real-time while said 
each node is servicing a request. 
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21. The computer program product of Claim 20, further comprising: 
executable code that collects said aggregated data from each of said plurality of 
nodes about said transaction. 

5 22. The computer program product of Claim 20, further comprising: 

executable code that collects said aggregated data from a portion of said plurality 
of nodes about said transaction. 

23. The computer program product of Claim 17, further comprising: 
executable code that aggregates XML message data received at each of said 

plurality of nodes, said plurality of nodes being a distributed network of service node 
peers. 

24. The computer program product of Claim 22, wherein each of said plurality of 
nodes is an application performing an operation in connection with servicing a 
transaction. 

25. The computer program product of Claim 24, wherein said current set of rules 
is evaluated in accordance with each received message. 

20 

26. The computer program product of Claim 25, further comprising: 
executable code that revises said current set of rules at one of said plurality of 

nodes while said one node is servicing a request. 
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27. The computer program product of Claim 25, wherein each rule in said current 
set of rules includes a condition portion and an action portion, and the computer program 
product further comprising: 
5 executable code that evaluates a condition portion of a first rule in accordance 

with a first received message wherein said condition portion evaluates to false and said 
action portion is not performed; and 

executable code that evaluates said condition portion of said first rule in 
accordance with a second received message wherein said condition portion evaluates to 
1 0 true and said action portion is performed. 



28. The computer program product of Claim 27, wherein said action portion 
includes performing at least one of: outputting data to a destination and invoking an 
application. 

15 

29. The computer program product of Claim 17, wherein a transaction is 
determined in accordance with at least one of: a transaction identifier, a customer 
identifier, and a timestamp included in each of said at least one message. 



20 30. The computer program product of Claim 29, wherein said executable code 

that processes includes executable code that analyzes said local filtered data at at least a 
portion of said plurality of nodes in accordance with a time-coherency and key-value 
pattern matching. 
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3 1 . The computer program product of Claim 30, further comprising: 
executable code that determines a first time for performing a first operation at a 

first of said plurality of nodes; 

executable code that determines a second time for performing a second operation 
at a second of said plurality of nodes; 

executable code that analyzes first local filtered data at said first node using an 
identifier associated with a transaction producing a first transaction data set; 

executable code that analyzes second local filtered data at said second node using 
said identifier producing a second transaction data set; and 

executable code that determines that said first and second transaction data sets are 
messages received by each of said first and second nodes for performing different 
operations for a same transaction at different points in time. 

32. The computer. program product of Claim 3 1 , further comprising: 
executable code that determines a processing path of operations performed by one 

or more of said plurality of nodes in connection with servicing said transaction in 
accordance with said identifier associated with said transaction. 
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